28K Users' Devices Infected, Attackers Made Off With Only $6K

Malware has compromised tens of thousands of devices to mine cryptocurrency and steal funds, yet it has only managed to secure around $6,000.

On 8 October, cybersecurity firm Doctor Web reported the detection of malware masquerading as legitimate software, including office applications, gaming cheats, and online trading bots.

This cryptojacking and theft software has infected over 28,000 users, primarily in Russia, with additional cases in Belarus, Uzbekistan, Kazakhstan, Ukraine, Kyrgyzstan, and Turkey.

While the hackers collected about $6,000 worth of cryptocurrency, it remains unclear how much the malware's creator may have gained from crypto mining.

Doctor Web noted that the malware was distributed through fraudulent GitHub pages and malicious links in YouTube video descriptions.

Once a device is compromised, the stealthy software hijacks computing resources for mining.

Additionally, a component known as a "Clipper" monitors the clipboard for cryptocurrency wallet addresses, replacing them with those controlled by the attackers, facilitating their small-scale theft.

The malware employs advanced techniques to evade detection, including using password-protected archives to avoid antivirus scans, disguising harmful files as legitimate system components, and executing malicious scripts with authorised software.

Doctor Web advised that many victims fell prey by installing pirated versions of popular programmes and recommended obtaining software only from official sources.

What is Clipboard-Changing Malware?

Clipboard-changing malware has existed for years, gaining significant traction following the 2017 cryptocurrency bull market.

It is a type of malicious software that sneaks onto your computer or phone and secretly alters the information you copy to your clipboard (the place where data is temporarily stored when you cut or copy text).

For example, if you copy a cryptocurrency wallet address to send money, the malware can replace it with a different address.

This means that, instead of sending your money to the intended person, it gets sent to the criminal's account.

This increased complexity makes them more dangerous and difficult to detect, posing a growing threat to unsuspecting users, especially in financial transactions like cryptocurrency transfers.

Over time, these malicious programmes have evolved, becoming more sophisticated by incorporating clipboard hijacking with other harmful features.